# NIST CSF 2.0

Source: https://s3msecurity.com/compliance/nist-csf/
Last updated: 2026-11-12

S3M supports nine NIST CSF 2.0 subcategories across Identify, Protect and Detect. ConnGuard NAC and APNZone inventory hardware down to the SIM, ConnGuard NAC, EndGuard and CityGate authenticate and limit access, SpotGate separates guests, and SAMI keeps audit-ready records that show who used which device and when.

**NIST Cybersecurity Framework 2.0 (CSWP 29).** Applies to: Any organization managing cybersecurity risk; use is voluntary. Official text: https://doi.org/10.6028/NIST.CSWP.29

## How S3M supports it

| Article / control | What it asks | How S3M supports it | Products |
| --- | --- | --- | --- |
| ID.AM-01 | Keep inventories of the hardware the organization manages. | ConnGuard NAC discovers network devices, and APNZone records each cellular device by its hardware fingerprint and SIM. | ConnGuard NAC, APNZone |
| PR.AA-01 | Manage identities and credentials for users, services and hardware. | EndGuard binds each device to its user, and APNZone binds each SIM to its device. User accounts stay in your identity provider. | EndGuard, APNZone |
| PR.AA-03 | Authenticate users, services and hardware. | ConnGuard NAC authenticates users and devices with 802.1X and RADIUS, and EndGuard keeps verifying during the session. S3M does not provide multi-factor authentication. | ConnGuard NAC, EndGuard |
| PR.AA-05 | Define, enforce and review access permissions with least privilege. | ConnGuard NAC and CityGate enforce least-privilege network access by identity, device and role. | ConnGuard NAC, CityGate |
| PR.IR-01 | Protect networks and environments from unauthorized logical access and use. | ConnGuard NAC keeps unknown devices off the network, CityGate segments without VLANs and SpotGate keeps guests apart. | ConnGuard NAC, CityGate, Spotgate |
| PR.PS-04 | Generate log records and make them available for continuous monitoring. | SAMI and SpotGate keep audit-ready records of network access and guest sessions. | SAMI, Spotgate |
| DE.CM-01 | Monitor networks and network services for adverse events. | APNZone detects unauthorized SIMs, and ConnGuard NAC sees every new device that connects. | APNZone, ConnGuard NAC |
| DE.CM-03 | Monitor personnel activity and technology use for adverse events. | SAMI answers who connected, from which device and when, from telemetry, with the source shown. | SAMI |
| DE.CM-09 | Monitor computing hardware and software for adverse events. | EndGuard checks device posture throughout each session and isolates an endpoint that turns compromised. | EndGuard |

S3M supports these requirements with technical controls. This is not legal advice or a certification; confirm legal questions with your counsel.

Checked against the official text on 2026-11-12.

## Frequently asked questions

### Which CSF 2.0 functions does S3M support?

Identify, Protect and Detect, through the nine subcategories in the table. Govern, Respond and Recover rely mostly on your own processes.

### Is NIST CSF 2.0 mandatory?

No. It is a voluntary framework, though many regulators, customers and US agencies refer to it.

### Does S3M map to CSF 1.1 as well?

This page uses CSF 2.0, published in February 2024. CSF 1.1 subcategory numbers are different.